5465b65756
WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
177 lines
7.3 KiB
Markdown
177 lines
7.3 KiB
Markdown
# Sirius Press
|
|
|
|
WordPress, with the mailbox taken out of the middle of it.
|
|
|
|
An account on a Sirius Press site is a Bitcoin Cash address. Signing in means
|
|
signing a challenge with the key that controls it. There is no registration
|
|
email, no confirmation link, no password reset — and no list of your readers'
|
|
email addresses sitting in a database waiting to leak.
|
|
|
|
Everything the site publishes is also mirrored, as plain static HTML, to the
|
|
BCNR name it belongs to. When the server is down, being upgraded, or seized,
|
|
the name keeps serving the last thing it published.
|
|
|
|
It is still WordPress. Yoast, WooCommerce, Contact Form 7 and the rest of the
|
|
ecosystem install and run; roles, capabilities, nonces and the REST API are
|
|
untouched. The fork's diff against upstream core is **one file, 75 lines** —
|
|
everything else is plugins.
|
|
|
|
---
|
|
|
|
## What this is for
|
|
|
|
You own a BCNR name. You want a real site behind it — one with an editor, a
|
|
media library, plugins, a theme you did not have to write — without the two
|
|
things WordPress assumes and this project rejects:
|
|
|
|
1. **That identity comes from email.** It does not. A mailbox is rented from
|
|
somebody who can close it, read it, or be compelled to hand it over. A key
|
|
is not.
|
|
2. **That the site lives at one server.** Sirius Press publishes a static copy
|
|
of every page to your name's storage on Sia, signed by the key that owns the
|
|
name. Readers reach that copy through any BCNR resolver, with no DNS and no
|
|
certificate authority in the path.
|
|
|
|
Email itself still works. `wp_mail()` is not disabled — configure SMTP and your
|
|
contact forms send, your WooCommerce receipts arrive. The objection was never
|
|
to email as a feature. It was to email as an identity.
|
|
|
|
---
|
|
|
|
## Getting it running
|
|
|
|
On a fresh Ubuntu 22.04 or 24.04 server:
|
|
|
|
```bash
|
|
curl -fsSL https://silentmode.st/sirius-press/install.sh | sudo bash
|
|
```
|
|
|
|
That installs Docker if needed, brings up MariaDB + PHP-FPM + nginx, and prints
|
|
the URL to finish setup. It takes about five minutes on a small VPS, most of it
|
|
building the PHP image.
|
|
|
|
For shared hosting, a `.zip` you can upload is on
|
|
[the releases page](https://code.silentmode.st/silentmode/sirius-press/releases).
|
|
|
|
Full instructions, including how to point your name at it:
|
|
**[docs/install.md](docs/install.md)**.
|
|
|
|
---
|
|
|
|
## How it works
|
|
|
|
### Signing in
|
|
|
|
The login page issues a short, single-use challenge. You sign it, the server
|
|
recovers the public key from the signature, derives the address, and looks up
|
|
the account. Nothing is typed but the signature.
|
|
|
|
Three ways to produce it, in order of preference:
|
|
|
|
- **A wallet the browser already has.** Theseus exposes one; the key never
|
|
touches the page.
|
|
- **A recovery phrase typed into the login form.** Used once, in the page, then
|
|
wiped. It is never transmitted — only the signature is.
|
|
- **Any Bitcoin Cash wallet at all.** The challenge is a BIP-137 message, the
|
|
format Electron Cash has had a "Sign message" box for since forever. Copy the
|
|
text, sign it on a machine that never touches the web, paste the result back.
|
|
This path works with JavaScript switched off.
|
|
|
|
The signature becomes an ordinary WordPress session cookie. Everything
|
|
downstream — `current_user_can()`, nonces, REST permissions, every plugin that
|
|
checks a capability — behaves exactly as it does on stock WordPress.
|
|
|
|
**There is no password reset, because there is nothing to reset.** If you lose
|
|
your phrase, the account is gone. An administrator can point an account at a
|
|
new address from the user editor, which makes recovery a decision a human
|
|
makes about a person they recognise — not something an attacker triggers by
|
|
compromising a mailbox. [docs/accounts.md](docs/accounts.md) says this at more
|
|
length, and the fork's "lost password" page says it to your users.
|
|
|
|
### Publishing
|
|
|
|
Publish a post and the affected pages — the post, the home page, the archives
|
|
it belongs to — are queued. Draining the queue renders each page over a
|
|
loopback request, rewrites its links to be document-relative, and PUTs it to
|
|
`/api/site/<name>/<path>` on the BNS gateway, signed by the key that owns the
|
|
name.
|
|
|
|
Signing happens one of two ways, and the choice is yours:
|
|
|
|
| | Where the key lives | Unattended publishing |
|
|
|---|---|---|
|
|
| **Manual** (default) | Nowhere. You type the phrase on the Publishing screen, it signs in your browser and uploads straight to the gateway. | No — the queue waits for you. |
|
|
| **Automatic** | Encrypted in the database, under `SIRIUS_PRESS_KEY` from `wp-config.php`. | Yes — cron drains the queue. |
|
|
|
|
Automatic is genuinely convenient and genuinely risky, and the settings screen
|
|
says so in those words. The gateway only accepts writes signed by the name's
|
|
current on-chain owner, so the key that can publish for your name is the key
|
|
that owns your name and its funds. There is no middle option where the server
|
|
holds something weaker; that is a property of the protocol, not a gap in this
|
|
fork. [docs/publishing.md](docs/publishing.md) has the details.
|
|
|
|
---
|
|
|
|
## Layout
|
|
|
|
```
|
|
plugins/
|
|
sirius-press-core/ wallet crypto, gateway client, settings, the inbox
|
|
sirius-press-auth/ wallet sign-in, registration, the recovery page
|
|
sirius-press-sia-export/ the static export queue and uploader
|
|
sirius-press-compat/ shims for plugins that insist on an admin email
|
|
mu-plugins/ the bits that must load before plugins do
|
|
patches/ the core diff — currently one file
|
|
docker/ compose stack: MariaDB, PHP-FPM, nginx
|
|
tools/ build, upstream update, release
|
|
tests/ 132 checks, no framework, runs in under a second
|
|
docs/
|
|
```
|
|
|
|
### Where WordPress itself is
|
|
|
|
Not in this repository. `tools/wordpress.lock` pins an exact upstream version
|
|
and its SHA-256; `tools/build.sh` and the Docker image each download it, verify
|
|
the hash, and apply `patches/`.
|
|
|
|
This deviates from the original plan of vendoring core as a git subtree, and
|
|
the reason is arithmetic: WordPress 7.1.1 is 149 MB and 5,008 files, and the
|
|
fork's entire core diff is 75 lines in one file. Carrying the former to express
|
|
the latter would make every clone, every `git status` and every subtree split
|
|
in the parent monorepo pay for a patch you can read in a minute. Upstream
|
|
security releases still merge cleanly — `tools/update-wordpress.sh` bumps the
|
|
pin, reapplies the series with fuzz, and tells you exactly which hunk needs a
|
|
human if one does. [docs/upstream-merges.md](docs/upstream-merges.md) covers
|
|
the procedure and how to switch to a vendored subtree if you would rather.
|
|
|
|
---
|
|
|
|
## Requirements
|
|
|
|
- PHP 7.4+ — 8.2 or newer recommended
|
|
- **GMP or BCMath.** Not optional: the wallet cryptography runs in PHP. GMP is
|
|
about twenty times faster and is what the Docker image uses.
|
|
- 64-bit PHP — address checksums need 40-bit arithmetic
|
|
- OpenSSL, for encrypting a stored publishing key
|
|
- MySQL 5.7+ / MariaDB 10.4+
|
|
|
|
---
|
|
|
|
## Testing
|
|
|
|
```bash
|
|
tests/run.sh
|
|
```
|
|
|
|
132 checks, no framework, about a second. The suite that matters most is
|
|
`tests/interop.mjs`, which pins the browser wallet against the PHP one: both
|
|
implement secp256k1, RFC 6979, BIP-32 and BIP-137 independently, and every
|
|
vector in the suite came from libauth — the library the Sirius portal wallet
|
|
and the BNS gateway both use. A signature made in a browser verifies on the
|
|
server and at the gateway, or the suite fails.
|
|
|
|
---
|
|
|
|
## Licence
|
|
|
|
GPL-2.0-or-later, inherited from WordPress.
|